PHP2Shell & Multipart Heap Exhaustion: How to Harden Apache & LiteSpeed Servers

Understanding the PHP2Shell Attack Vectors

Recent cybersecurity intelligence revealed significant heap exhaustion vectors in PHP's core multipart form parser (tracked under CVE-2026-109618 and CVE-2026-109619). Dubbed PHP2Shell by security researchers, these vulnerabilities exploit how the PHP runtime parses HTTP requests utilizing Transfer-Encoding: chunked alongside nested multipart/form-data payloads.

When an attacker streams an infinite sequence of small chunked multipart boundary headers without terminating the stream, PHP allocates linked structures on the internal process heap faster than garbage collection can sweep them, leading to server-wide Denial of Service.

Layered Server Hardening Protocol

• Web Server Pre-PHP Gateway: Block chunked multipart requests at the Apache/LiteSpeed rewrite layer before PHP boot.
• Enforce 20MB Ceiling: Restrict Content-Length before initializing PHP worker memory pools.
• Strict php.ini Limits: Set max_multipart_body_parts = 50, max_input_vars = 1000, and max_input_nesting_level = 32.